WireGuard is a VPN that runs inside the Linux kernel. This is an advanced guide for an ArkHost KVM Linux VPS. It explains a safe order of work rather than a ready made configuration.
Whether WireGuard can run depends on the virtualization and operating system supplied with your service. On a KVM VPS the required kernel support is normally available. On container based virtualization, kernel and network support depends on what the platform supplies.
Before you begin
WireGuard changes firewall and routing behavior on the VPS. A mistake can cut off your own remote access.
Install from your distribution packages
Install WireGuard from the normal package repository of the Linux distribution on your VPS. The package is usually named wireguard and provides the wg and wg-quick tools. Use your distribution documentation for the exact installation command for your release.
Do not install WireGuard by piping a downloaded script into a shell. Third party installer scripts run with full root privileges and cannot be verified from this article.
Configure the interface
A WireGuard setup consists of an interface on the server and one or more peers. In outline:
- Generate a private and public key pair for the server and for each peer with the
wgtools. - Create an interface configuration, conventionally
/etc/wireguard/wg0.conf, containing the server private key, a listen port and the peer definitions. - Choose private tunnel addresses that do not overlap with networks you already use.
- Allow the chosen UDP listen port in your firewall before starting the interface.
The exact directives and file locations are described in the WireGuard documentation and your distribution documentation. Follow those documents for your release instead of copying a complete configuration from an unverified source.
Start and verify
Start the interface with the wg-quick@wg0 system service, then verify before you depend on it:
- Check the interface and peer handshake state with
wg show. - Check the service status with
systemctl status wg-quick@wg0. - Connect one peer and confirm traffic passes before you add more peers or change other services.
Only route administration traffic over the VPN after a peer has connected reliably, and keep the console recovery route available.
